If it isn’t broken and does what you need, why update, you know what I mean? Especially if it isn’t connected to the internet in some cases. 😁

I agree with that assessment whenever it's not connected to the internet. But, if it is, I actually find it hard to justify for myself to not (at least) receive the security updates. Which, in the case of non-frozen packages, suggests applying regular updates.

But yeah, more than anything, I think this touches on threat models. Which are very subjective by themselves and thus probably not very interesting to discuss 😜.

Regarding what you linked to paccache, which setting(s) were you referring to specifically? I don’t think I was able to understand that it is directly suggesting or indirectly insinuating any type of update frequency. But I probably am just too tired to process. 😅

My apologies, perhaps I should have been more elaborate. So, paccache's man page mentions a systemd timer it refers to as paccache.timer. With it, package cache can be cleaned periodically. And, by default, it does so weekly.

As to why this suggests weekly updates as a lower bound, paccache removes old packages. Thus, from my understanding, paccache goes hand in hand with updates; updates yield the old packages which will be deleted by paccache. As such, for two consecutive paccaches to do anything, an update has to have occurred in between. Thus, if paccache.timer defaults to weekly cleanups, then it has to be accompanied with at least a weekly update.

Of course, paccache will handle higher update frequencies without any problem. Thus, updating only once a week becomes a lower bound for paccache.timer's default functionality.

To be clear, I only said "suggest" :P . I can't do any stronger claims 😅.